@stackframe/stack-cli 2.8.83 → 2.8.85

package/dist/index.js

@@ -7,6 +7,7 @@ import * as path from "path";
 import { dirname, join, resolve } from "path";
 import { StackClientApp } from "@stackframe/js";
 import * as os from "os";
+import { homedir } from "os";
 import { detectImportPackageFromDir, renderConfigFileContent } from "@stackframe/stack-shared/dist/config-rendering";
 import { checkbox, confirm, input, select } from "@inquirer/prompts";
 import { ALL_APPS } from "@stackframe/stack-shared/dist/apps/apps-config";
@@ -72,6 +73,9 @@ function resolveRefreshToken() {
 	if (!token) throw new AuthError("Not logged in. Run `stack login` first.");
 	return token;
 }
+function resolveSecretServerKey() {
+	return process.env.STACK_SECRET_SERVER_KEY ?? null;
+}
 function resolveProjectId(flags) {
 	const projectId = flags.projectId ?? process.env.STACK_PROJECT_ID;
 	if (!projectId) throw new AuthError("No project ID specified. Use --project-id or set STACK_PROJECT_ID.");
@@ -90,11 +94,23 @@ function resolveSessionAuth(flags) {
 	};
 }
 function resolveAuth(flags) {
+	const secretServerKey = resolveSecretServerKey();
+	if (secretServerKey) return {
+		...resolveLoginConfig(flags),
+		projectId: resolveProjectId(flags),
+		secretServerKey
+	};
 	return {
 		...resolveSessionAuth(flags),
 		projectId: resolveProjectId(flags)
 	};
 }
+function isProjectAuthWithSecretServerKey(auth) {
+	return "secretServerKey" in auth;
+}
+function isProjectAuthWithRefreshToken(auth) {
+	return "refreshToken" in auth;
+}
 
 //#endregion
 //#region src/commands/login.ts
@@ -170,7 +186,9 @@ function getErrorMessage(err) {
 function registerExecCommand(program) {
 	program.command("exec [javascript]").description("Execute JavaScript with a pre-configured StackServerApp as `stackServerApp`").addHelpText("after", "\nFor available API methods, see: https://docs.stack-auth.com/docs/sdk").action(async (javascript) => {
 		if (javascript === void 0) throw new CliError("Missing JavaScript argument. Use `stack exec \"<javascript>\"` or `stack exec --help`.");
-		const project = await getAdminProject(resolveAuth(program.opts()));
+		const auth = resolveAuth(program.opts());
+		if (!isProjectAuthWithRefreshToken(auth)) throw new CliError("`stack exec` requires `stack login`. Remove STACK_SECRET_SERVER_KEY and try again.");
+		const project = await getAdminProject(auth);
 		const AsyncFunction = Object.getPrototypeOf(async function() {}).constructor;
 		let fn;
 		try {
@@ -190,15 +208,72 @@ function registerExecCommand(program) {
 
 //#endregion
 //#region src/commands/config-file.ts
-function isPlainObject(value) {
+function isConfigOverride(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
 	const prototype = Object.getPrototypeOf(value);
 	return prototype === Object.prototype || prototype === null;
 }
+function parseGitHubRepository() {
+	const repository = process.env.GITHUB_REPOSITORY;
+	if (!repository) return null;
+	const slashIndex = repository.indexOf("/");
+	if (slashIndex <= 0 || slashIndex >= repository.length - 1) return null;
+	return {
+		owner: repository.slice(0, slashIndex),
+		repo: repository.slice(slashIndex + 1)
+	};
+}
+function buildConfigPushSource(configFilePath) {
+	const repository = parseGitHubRepository();
+	const sha = process.env.GITHUB_SHA;
+	const branch = process.env.GITHUB_REF_NAME;
+	if (repository && sha && branch) return {
+		type: "pushed-from-github",
+		owner: repository.owner,
+		repo: repository.repo,
+		branch,
+		commit_hash: sha,
+		config_file_path: configFilePath
+	};
+	return { type: "pushed-from-unknown" };
+}
+async function pushConfigWithSecretServerKey(auth, config, source) {
+	const endpoint = `${auth.apiUrl.replace(/\/$/, "")}/api/v1/internal/config/override/branch`;
+	const response = await fetch(endpoint, {
+		method: "PUT",
+		headers: {
+			"content-type": "application/json",
+			"x-stack-project-id": auth.projectId,
+			"x-stack-access-type": "server",
+			"x-stack-secret-server-key": auth.secretServerKey
+		},
+		body: JSON.stringify({
+			config_string: JSON.stringify(config),
+			source
+		})
+	});
+	if (response.ok) return;
+	const responseText = await response.text();
+	throw new CliError(`Failed to push config with STACK_SECRET_SERVER_KEY: ${responseText.length > 0 ? responseText : `Request failed with status ${response.status}.`}`);
+}
+function sourceToSdkSource(source) {
+	if (source.type === "pushed-from-github") return {
+		type: "pushed-from-github",
+		owner: source.owner,
+		repo: source.repo,
+		branch: source.branch,
+		commitHash: source.commit_hash,
+		configFilePath: source.config_file_path
+	};
+	if (source.type === "pushed-from-unknown") return { type: "pushed-from-unknown" };
+	return { type: "unlinked" };
+}
 function registerConfigCommand(program) {
 	const config = program.command("config").description("Manage project configuration files");
 	config.command("pull").description("Pull branch config to a local file").requiredOption("--config-file <path>", "Path to write config file (.ts)").option("--overwrite", "Overwrite an existing config file").action(async (opts) => {
-		const configOverride = await (await getAdminProject(resolveAuth(program.opts()))).getConfigOverride("branch");
+		const auth = resolveAuth(program.opts());
+		if (!isProjectAuthWithRefreshToken(auth)) throw new CliError("`stack config pull` requires `stack login`. Remove STACK_SECRET_SERVER_KEY and try again.");
+		const configOverride = await (await getAdminProject(auth)).getConfigOverride("branch");
 		const filePath = path.resolve(opts.configFile);
 		if (path.extname(filePath) !== ".ts") throw new CliError("Config file must have a .ts extension. Typed config files require TypeScript.");
 		if (fs.existsSync(filePath) && !opts.overwrite) throw new CliError(`Config file already exists at ${filePath}. Stage or back up your changes, then re-run with --overwrite.`);
@@ -207,15 +282,20 @@ function registerConfigCommand(program) {
 		console.log(`Config written to ${filePath}`);
 	});
 	config.command("push").description("Push a local config file to branch config").requiredOption("--config-file <path>", "Path to config file (.js or .ts)").action(async (opts) => {
-		const project = await getAdminProject(resolveAuth(program.opts()));
+		const auth = resolveAuth(program.opts());
 		const filePath = path.resolve(opts.configFile);
 		const ext = path.extname(filePath);
 		if (ext !== ".js" && ext !== ".ts") throw new CliError("Config file must have a .js or .ts extension.");
 		if (!fs.existsSync(filePath)) throw new CliError(`Config file not found: ${filePath}`);
 		const { createJiti } = await import("jiti");
 		const config = (await createJiti(import.meta.url).import(filePath)).config;
-		if (!isPlainObject(config)) throw new CliError(`Config file must export a plain \`config\` object. Example: import type { StackConfig } from "${detectImportPackageFromDir(path.dirname(filePath)) ?? "@stackframe/js"}"; export const config: StackConfig = { ... };`);
-		await project.replaceConfigOverride("branch", config);
+		if (!isConfigOverride(config)) throw new CliError(`Config file must export a plain \`config\` object. Example: import type { StackConfig } from "${detectImportPackageFromDir(path.dirname(filePath)) ?? "@stackframe/js"}"; export const config: StackConfig = { ... };`);
+		const source = buildConfigPushSource(opts.configFile);
+		if (isProjectAuthWithSecretServerKey(auth)) await pushConfigWithSecretServerKey(auth, config, source);
+		else {
+			if (!isProjectAuthWithRefreshToken(auth)) throw new CliError("`stack config push` requires either STACK_SECRET_SERVER_KEY or `stack login`.");
+			await (await getAdminProject(auth)).pushConfig(config, { source: sourceToSdkSource(source) });
+		}
 		console.log("Config pushed successfully.");
 	});
 }
@@ -723,6 +803,60 @@ function registerProjectCommand(program) {
 
 //#endregion
 //#region src/commands/emulator.ts
+const DEFAULT_EMULATOR_BACKEND_PORT = 26701;
+function emulatorBackendPort() {
+	const raw = process.env.EMULATOR_BACKEND_PORT;
+	if (!raw) return DEFAULT_EMULATOR_BACKEND_PORT;
+	const parsed = Number(raw);
+	if (!Number.isInteger(parsed) || parsed <= 0) throw new CliError(`Invalid EMULATOR_BACKEND_PORT: ${raw}`);
+	return parsed;
+}
+function emulatorHome() {
+	return process.env.STACK_EMULATOR_HOME ?? join(homedir(), ".stack", "emulator");
+}
+function emulatorRunDir() {
+	return join(emulatorHome(), "run");
+}
+function emulatorImageDir() {
+	return join(emulatorHome(), "images");
+}
+function internalPckPath() {
+	return join(emulatorRunDir(), "vm", "internal-pck");
+}
+async function readInternalPck(timeoutMs = 6e4) {
+	const path = internalPckPath();
+	const deadline = Date.now() + timeoutMs;
+	let delay = 250;
+	while (Date.now() < deadline) {
+		if (existsSync(path)) {
+			const contents = readFileSync(path, "utf-8").trim();
+			if (contents) return contents;
+		}
+		await new Promise((r) => setTimeout(r, delay));
+		delay = Math.min(delay * 2, 2e3);
+	}
+	throw new CliError(`Timed out waiting for emulator internal publishable client key at ${path}`);
+}
+async function fetchEmulatorCredentials(pck, backendPort, configFile) {
+	const url = `http://127.0.0.1:${backendPort}/api/v1/internal/local-emulator/project`;
+	const res = await fetch(url, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			"X-Stack-Project-Id": "internal",
+			"X-Stack-Access-Type": "client",
+			"X-Stack-Publishable-Client-Key": pck
+		},
+		body: JSON.stringify({ absolute_file_path: configFile })
+	});
+	if (!res.ok) throw new CliError(`Failed to initialize local emulator project (${res.status}): ${await res.text()}`);
+	const data = await res.json();
+	return {
+		project_id: data.project_id,
+		publishable_client_key: data.publishable_client_key,
+		secret_server_key: data.secret_server_key
+	};
+}
 function gh(args) {
 	try {
 		return execFileSync("gh", args, {
@@ -738,28 +872,57 @@ function gh(args) {
 		throw new CliError("GitHub CLI (gh) is required. Install: https://cli.github.com/");
 	}
 }
-function findQemuDir() {
-	for (const rel of ["docker/local-emulator/qemu", "../docker/local-emulator/qemu"]) {
-		const dir = resolve(process.cwd(), rel);
-		if (existsSync(join(dir, "run-emulator.sh"))) return dir;
-	}
-	throw new CliError("Could not find QEMU emulator directory. Run this from the stack-auth repo root.");
+function emulatorScriptsDir() {
+	const here = dirname(fileURLToPath(import.meta.url));
+	const bundled = join(here, "emulator");
+	if (existsSync(join(bundled, "run-emulator.sh"))) return bundled;
+	const repo = resolve(here, "../../../docker/local-emulator/qemu");
+	if (existsSync(join(repo, "run-emulator.sh"))) return repo;
+	throw new CliError("Emulator scripts not found in CLI bundle.");
+}
+function emulatorSpawnEnv(extra) {
+	return {
+		...process.env,
+		EMULATOR_RUN_DIR: emulatorRunDir(),
+		EMULATOR_IMAGE_DIR: emulatorImageDir(),
+		...extra
+	};
 }
 function runEmulator(action, env) {
-	const qemuDir = findQemuDir();
-	return new Promise((resolve, reject) => {
-		const child = spawn(join(qemuDir, "run-emulator.sh"), [action], {
+	const scriptsDir = emulatorScriptsDir();
+	mkdirSync(emulatorRunDir(), { recursive: true });
+	mkdirSync(emulatorImageDir(), { recursive: true });
+	return new Promise((resolvePromise, reject) => {
+		const child = spawn(join(scriptsDir, "run-emulator.sh"), [action], {
 			stdio: "inherit",
-			env: {
-				...process.env,
-				...env
-			},
-			cwd: qemuDir
+			env: emulatorSpawnEnv(env),
+			cwd: scriptsDir
 		});
-		child.on("close", (code) => code === 0 ? resolve() : reject(new CliError(`run-emulator.sh ${action} exited with code ${code}`)));
+		child.on("close", (code) => code === 0 ? resolvePromise() : reject(new CliError(`run-emulator.sh ${action} exited with code ${code}`)));
 		child.on("error", (err) => reject(new CliError(`Failed to run run-emulator.sh: ${err.message}`)));
 	});
 }
+function isEmulatorRunning() {
+	const scriptsDir = emulatorScriptsDir();
+	try {
+		execFileSync(join(scriptsDir, "run-emulator.sh"), ["status"], {
+			stdio: "pipe",
+			cwd: scriptsDir,
+			env: emulatorSpawnEnv()
+		});
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function startEmulator(arch) {
+	mkdirSync(emulatorImageDir(), { recursive: true });
+	if (!existsSync(join(emulatorImageDir(), `stack-emulator-${arch}.qcow2`))) {
+		console.log("No emulator image found. Pulling latest...");
+		pullRelease(arch);
+	}
+	await runEmulator("start", { EMULATOR_ARCH: arch });
+}
 function resolveArch(raw) {
 	const arch = raw ?? (process.arch === "arm64" ? "arm64" : process.arch === "x64" ? "amd64" : null);
 	if (arch === "arm64" || arch === "amd64") return arch;
@@ -770,7 +933,7 @@ function pullRelease(arch, opts = {}) {
 	const branch = opts.branch ?? "dev";
 	const tag = opts.tag ?? `emulator-${branch}-latest`;
 	const asset = `stack-emulator-${arch}.qcow2`;
-	const imageDir = join(findQemuDir(), "images");
+	const imageDir = emulatorImageDir();
 	mkdirSync(imageDir, { recursive: true });
 	const dest = join(imageDir, asset);
 	const tmpDest = `${dest}.download`;
@@ -832,7 +995,7 @@ function registerEmulatorCommand(program) {
 				if (runs.length === 0) throw new CliError(`No successful build found for PR #${opts.pr} (branch: ${headRefName}).`);
 				runId = String(runs[0].databaseId);
 			}
-			const imageDir = join(findQemuDir(), "images");
+			const imageDir = emulatorImageDir();
 			mkdirSync(imageDir, { recursive: true });
 			const dest = join(imageDir, `stack-emulator-${arch}.qcow2`);
 			if (existsSync(dest)) unlinkSync(dest);
@@ -860,13 +1023,64 @@ function registerEmulatorCommand(program) {
 			tag: opts.tag
 		});
 	});
-	emulator.command("start").description("Start the emulator in the background (auto-pulls the latest image if none exists)").option("--arch <arch>", "Target architecture (default: current system arch). Non-native uses software emulation and is significantly slower.").action(async (opts) => {
+	emulator.command("start").description("Start the emulator in the background (auto-pulls the latest image if none exists)").option("--arch <arch>", "Target architecture (default: current system arch). Non-native uses software emulation and is significantly slower.").option("--config-file <path>", "Path to a config file; when set, credentials for this project are printed to stdout as JSON").action(async (opts) => {
 		const arch = resolveArch(opts.arch);
-		if (!existsSync(join(findQemuDir(), "images", `stack-emulator-${arch}.qcow2`))) {
-			console.log("No emulator image found. Pulling latest...");
-			pullRelease(arch);
+		let resolvedConfigFile;
+		if (opts.configFile) {
+			resolvedConfigFile = resolve(opts.configFile);
+			if (!existsSync(resolvedConfigFile)) throw new CliError(`Config file not found: ${resolvedConfigFile}`);
 		}
-		await runEmulator("start", { EMULATOR_ARCH: arch });
+		if (isEmulatorRunning()) console.warn("Emulator already running, reusing existing instance.");
+		else await startEmulator(arch);
+		if (resolvedConfigFile) {
+			const creds = await fetchEmulatorCredentials(await readInternalPck(), emulatorBackendPort(), resolvedConfigFile);
+			console.log(JSON.stringify(creds, null, 2));
+		}
+	});
+	emulator.command("run").description("Start the emulator, run a command, and stop the emulator when the command exits").argument("<cmd>", "Command to run (e.g. \"npm run dev\")").option("--arch <arch>", "Target architecture").option("--config-file <path>", "Path to a config file; fetches credentials and injects STACK_PROJECT_ID / STACK_PUBLISHABLE_CLIENT_KEY / STACK_SECRET_SERVER_KEY into the child").action(async (cmd, opts) => {
+		const arch = resolveArch(opts.arch);
+		let resolvedConfigFile;
+		if (opts.configFile) {
+			resolvedConfigFile = resolve(opts.configFile);
+			if (!existsSync(resolvedConfigFile)) throw new CliError(`Config file not found: ${resolvedConfigFile}`);
+		}
+		const alreadyRunning = isEmulatorRunning();
+		if (alreadyRunning) console.log("Emulator already running, reusing existing instance.");
+		else await startEmulator(arch);
+		const childEnv = { ...process.env };
+		if (resolvedConfigFile) {
+			const pck = await readInternalPck();
+			const backendPort = emulatorBackendPort();
+			const creds = await fetchEmulatorCredentials(pck, backendPort, resolvedConfigFile);
+			const apiUrl = `http://127.0.0.1:${backendPort}`;
+			childEnv.STACK_PROJECT_ID = creds.project_id;
+			childEnv.NEXT_PUBLIC_STACK_PROJECT_ID = creds.project_id;
+			childEnv.STACK_PUBLISHABLE_CLIENT_KEY = creds.publishable_client_key;
+			childEnv.NEXT_PUBLIC_STACK_PUBLISHABLE_CLIENT_KEY = creds.publishable_client_key;
+			childEnv.STACK_SECRET_SERVER_KEY = creds.secret_server_key;
+			childEnv.STACK_API_URL = apiUrl;
+			childEnv.NEXT_PUBLIC_STACK_API_URL = apiUrl;
+		}
+		const child = spawn(cmd, {
+			shell: true,
+			stdio: "inherit",
+			env: childEnv
+		});
+		const forward = (signal) => () => child.kill(signal);
+		const onSigint = forward("SIGINT");
+		const onSigterm = forward("SIGTERM");
+		process.on("SIGINT", onSigint);
+		process.on("SIGTERM", onSigterm);
+		child.on("close", (code) => {
+			process.off("SIGINT", onSigint);
+			process.off("SIGTERM", onSigterm);
+			const exitCode = code ?? 1;
+			if (alreadyRunning) process.exit(exitCode);
+			else {
+				console.log("\nStopping emulator...");
+				runEmulator("stop").catch(() => {}).finally(() => process.exit(exitCode));
+			}
+		});
 	});
 	emulator.command("stop").description("Stop the emulator (data preserved; use 'reset' to clear)").action(() => runEmulator("stop"));
 	emulator.command("reset").description("Reset emulator state for a fresh boot").action(() => runEmulator("reset"));